Malicious Code Injection in color-list Package - PyPI Vulnerability
Summary
MAL-2026-1479: Malicious code in color-list (PyPI). Affects color-list versions 1.0.1 – 1.0.2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The color-list package is a Python library available on the Python Package Index (PyPI) that is designed to provide a collection of color names and their corresponding values. It is often used in applications requiring color manipulation or display. However, this package has been compromised, leading to the inclusion of malicious code that can trigger harmful actions when certain conditions are met.
Vulnerability Detail
The vulnerability originates from malicious code embedded within the color-list package, specifically versions 1.0.1 and 1.0.2. This code is designed to activate when the pretty-tabulate package is present, subsequently loading additional malicious code from a third-party package. The simultaneous publication of these packages by accounts that had been inactive for a year raises concerns about hijacked access. The malicious intent is clear, as the code is obfuscated and included intentionally as a dependency, posing risks such as data theft or unauthorized access.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall color-listIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can avoid using the color-list package or any dependent packages that may trigger the malicious code. Additionally, ensure that you do not have the pretty-tabulate package installed if you are using color-list.
Conclusion
The color-list package has been compromised with malicious code that activates under specific conditions. Users are advised to remove the affected versions and monitor their applications for vulnerabilities. Utilizing tools like Vulert can help in identifying and mitigating such risks effectively.
See every vulnerability recorded for color-list →
FAQ
The color-list package is a Python library that provides a collection of color names and their corresponding values, useful for applications that require color manipulation.
The malicious code activates when the pretty-tabulate package is present, loading additional harmful code from a third-party source.
You should remove the affected versions (1.0.1 and 1.0.2) and update to a patched version if available, or remove the package entirely until a secure version is released.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without needing to sign up.
Using the compromised package can lead to data theft, unauthorized access, and other malicious activities due to the embedded malicious code.
